Bump ya-passport-auth to 1.3.0 for Yandex Smart Home provider

[trudenboy]

Yandex Smart Home — dependency bump

Bumps the provider's auth library ya-passport-auth from 1.2.3 to 1.3.0.

Source: trudenboy/ma-provider-yandex-smarthome · tag v1.3.0

---

Why

Upstream ya-passport-auth 1.3.0 adds OAuth Device Flow (RFC 8628) as a third login method and the Credentials.refresh_token field (backwards compatible, defaults to None).

• Changelog: https://github.com/trudenboy/ya-passport-auth/blob/main/CHANGELOG.md
• PyPI: https://pypi.org/project/ya-passport-auth/1.3.0/

Scope of this PR

No provider-side code changes. The provider only consumes SecretStr from the library, whose contract is unchanged. Runtime constraints are identical: aiohttp<4,>=3.10, yarl>=1.12, Python ≥3.12.

Files

File	Change
music_assistant/providers/yandex_smarthome/manifest.json	ya-passport-auth==1.2.3 → 1.3.0
requirements_all.txt	ya-passport-auth==1.2.3 → 1.3.0
tests/providers/yandex_smarthome/test_basic.py	assertion updated to ==1.3.0

3 files changed, 3 insertions(+), 3 deletions(-).

---

Follow-up to #3615. Draft until reviewed.

[github-actions]

🔒 Dependency Security Report

📦 Modified Dependencies

music_assistant/providers/yandex_smarthome/manifest.json

Added:

• ✅ ya-passport-auth ==1.3.0

Removed:

• ❌ ya-passport-auth ==1.2.3

The following dependencies were added or modified:

diff --git a/requirements_all.txt b/requirements_all.txt
index c0f36ece..951753c3 100644
--- a/requirements_all.txt
+++ b/requirements_all.txt
@@ -88,7 +88,7 @@ uv>=0.8.0
 websocket-client==1.9.0
 wiim==0.1.1
 xmltodict==1.0.4
-ya-passport-auth==1.2.3
+ya-passport-auth==1.3.0
 yandex-music==2.2.0
 ytmusicapi==1.11.5
 zeroconf==0.148.0

New/modified packages to review:

• ya-passport-auth==1.3.0

---

🔍 Vulnerability Scan Results

No known vulnerabilities found

Name	Skip Reason
torch	Dependency not found on PyPI and could not be audited: torch (2.11.0+cpu)
torchaudio	Dependency not found on PyPI and could not be audited: torchaudio (2.11.0+cpu)
✅ No known vulnerabilities found

---

Automated Security Checks

• ✅ Vulnerability Scan: Passed - No known vulnerabilities
• ✅ Trusted Sources: All packages have verified source repositories
• ✅ Typosquatting Check: No suspicious package names detected
• ✅ License Compatibility: All licenses are OSI-approved and compatible
• ✅ Supply Chain Risk: Passed - packages appear mature and maintained

Manual Review

Maintainer approval required:

• I have reviewed the changes above and approve these dependency updates

To approve: Comment /approve-dependencies or manually add the dependencies-reviewed label.

[Copilot]

Pull request overview

Bumps the Yandex Smart Home provider’s ya-passport-auth dependency to 1.3.0, aligning the provider manifest, consolidated requirements list, and the provider’s manifest-validation test.

Changes:

• Update provider manifest requirement ya-passport-auth==1.2.3 → ==1.3.0.
• Update requirements_all.txt pin to ya-passport-auth==1.3.0.
• Update the corresponding test assertion to expect ==1.3.0.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
music_assistant/providers/yandex_smarthome/manifest.json	Bump provider requirement pin to ya-passport-auth==1.3.0.
requirements_all.txt	Bump global aggregated requirements pin to ya-passport-auth==1.3.0.
tests/providers/yandex_smarthome/test_basic.py	Update manifest requirement assertion to ==1.3.0.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.